swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up

A new swarm service, `swarm-claude-login`, in its own container on the host
that sets `deploy.claude-login.enable` (defaulted on by `allSwarmServices`
where the host has the minter's store leaf, like the review classifier).

- swarm-ui: an agent card showing "login needed" gets a "log in" button.
  Its dialog starts the login, shows the URL claude printed, and takes the
  pasted code.
- swarm-controller: `POST/DELETE /api/agents/{name}/claude-login` and
  `POST /api/agents/{name}/claude-login/code`, behind the swarm UI's
  authelia-gated `/api/`, relay the steps to the minter as requests on
  `$SWARM.claude-login.request`.
- swarm-claude-login: runs `claude auth login` over piped stdio with HOME
  and CLAUDE_CONFIG_DIR in a per-login scratch dir, scrapes the first
  https URL, writes the code to stdin, and stores the `.credentials.json`
  at `swarm/agents/<agent>/claude-credentials` with a KV v2 write, a new
  version over any earlier one. The scratch dir goes on every exit path; a
  login waits 15 minutes for its code.
- hive-agent: while parked in `wait_for_login`, reads that leaf every 30 s
  under the agent's own cert and installs it only when its KV version is
  newer than the one recorded in `<harness>/claude-credentials-version`.
  An equal or older version is never put back, because claude rotates the
  refresh token and the stored copy is stale after the first refresh.
- swarm-secret-client: `claude_login` paths and `SecretStore::read_versioned`.
- Credentials: a `claude-login` store leaf minted by glue-bao-tls, a
  `swarm-claude-login` policy (create/update on
  `swarm/agents/+/claude-credentials`, read on its own queue client
  secret), an authelia machine client, and a `--claude-login-client`
  grant in the queue's auth-callout responder. The unit runs as a static
  system user.

The hive's own web-UI login is unchanged.

Refs #5268

frontend/packages/swarm-ui/test/claude-login.test.mjs

@@ -0,0 +1,54 @@
+// The claude login dialog's step logic. Run by `npm test`, which Node runs
+// with its built-in test runner and type stripping, so the `.ts` module is
+// imported as it is.
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  afterCode,
+  afterStart,
+  claudeLoginPath,
+  leavesLoginRunning,
+  pastedCode,
+} from "../src/agent/claude-login/ClaudeLoginSteps.ts";
+
+test("the routes name the agent, escaped", () => {
+  assert.equal(claudeLoginPath("atlas"), "/api/agents/atlas/claude-login");
+  assert.equal(
+    claudeLoginPath("atlas", true),
+    "/api/agents/atlas/claude-login/code",
+  );
+  assert.equal(claudeLoginPath("a/b"), "/api/agents/a%2Fb/claude-login");
+});
+
+test("a started login asks for the code at its URL", () => {
+  assert.deepEqual(afterStart({ url: "https://claude.ai/oauth/x" }), {
+    step: "code",
+    url: "https://claude.ai/oauth/x",
+  });
+});
+
+test("a start that failed shows why and has no URL", () => {
+  const problem = { detail: "no claude login minter is listening" };
+  assert.deepEqual(afterStart({ problem }), { step: "failed", problem });
+});
+
+test("an accepted code is stored; a refused one is a failure", () => {
+  assert.deepEqual(afterCode(null), { step: "stored" });
+  const problem = { detail: "OAuth error: invalid code" };
+  assert.deepEqual(afterCode(problem), { step: "failed", problem });
+});
+
+test("only a login waiting for its code is stopped on close", () => {
+  assert.equal(leavesLoginRunning({ step: "code", url: "https://u" }), true);
+  assert.equal(leavesLoginRunning({ step: "starting" }), false);
+  assert.equal(
+    leavesLoginRunning({ step: "submitting", url: "https://u" }),
+    false,
+  );
+  assert.equal(leavesLoginRunning({ step: "stored" }), false);
+});
+
+test("a pasted code is trimmed, and a blank one is nothing", () => {
+  assert.equal(pastedCode("  abc-def \n"), "abc-def");
+  assert.equal(pastedCode(" \n "), null);
+});